4,200 件 ・ 関連度順
概要と使いどころ
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
日本語の概要は準備中です。原文の説明を表示しています。
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules
日本語の概要は準備中です。原文の説明を表示しています。
Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.
日本語の概要は準備中です。原文の説明を表示しています。
Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.
日本語の概要は準備中です。原文の説明を表示しています。
Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
日本語の概要は準備中です。原文の説明を表示しています。
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.
日本語の概要は準備中です。原文の説明を表示しています。
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
日本語の概要は準備中です。原文の説明を表示しています。
Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.
日本語の概要は準備中です。原文の説明を表示しています。
Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.
日本語の概要は準備中です。原文の説明を表示しています。
Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
日本語の概要は準備中です。原文の説明を表示しています。
Extract DPAPI-protected secrets such as credentials and browser data offline and online.
日本語の概要は準備中です。原文の説明を表示しています。
Convert LaTeX papers between journal/conference templates for journal resubmission or template switching (e.g., Springer → MDPI, IEEE → Nature, IPOL → CVPR) through a privacy-preserving anonymized workflow. Use when the user provides a LaTeX .tex/project plus a target template directory or .tex file. Assume the input is not anonymized unless the user explicitly says it is already anonymized. Preserve privacy sentinels exactly; never open mapping.private.json except as a local script argument.
日本語の概要は準備中です。原文の説明を表示しています。
Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when editing or restructuring a skill directory (moving files to references/ or scripts/, removing stale content, validating against the AgentSkills spec). Triggers on phrases like "create a skill", "author a skill", "tidy up a skill", "improve this skill", "review the skill", "clean up the skill", "audit the skill".
日本語の概要は準備中です。原文の説明を表示しています。
Control Claude Code via MCP protocol. Trigger with "plan" to write a precise execution plan then feed it to Claude Code. Also supports direct commands, persistent sessions, agent teams, and advanced tool control.
日本語の概要は準備中です。原文の説明を表示しています。
Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type generation.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive Cline SDK skill for building AI agents. Covers the direct Agent runtime, ClineCore sessions, custom tools, plugins, events, LLM providers, scheduling, multi-agent teams, and production deployment. Use for any task involving @cline/sdk or its sub-packages.
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when creating comprehensive project plans for system development or implementation projects. Use this skill when you need to create Project Charters, Project Plans, WBS, Gantt Charts, RACI matrices, Risk analysis, or other PMBOK-aligned project management artifacts. Outputs are in Markdown format with Mermaid diagrams for visualizations. Leverages comprehensive PM knowledge base in references/ directory (544KB, 11 files) including PMBOK standards, Software/SaaS best practices, IT industry guidance, and specialized PM methodologies.
日本語の概要は準備中です。原文の説明を表示しています。
Design new Claude skills from structured idea specifications. Use when the skill auto-generation pipeline needs to produce a Claude CLI prompt that creates a complete skill directory (SKILL.md, references, scripts, tests) following repository conventions.
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrates multi-step tasks autonomously using a 3-tier agent hierarchy (Director/Manager/Worker). Use when user says "run this end-to-end", "handle everything", "execute all tasks", or needs parallel task execution with queuing, course correction, and session resume. Provides FIFO task queue, escalation policy, git worktree isolation, and context persistence across agent sessions.
日本語の概要は準備中です。原文の説明を表示しています。
Find the canonical Rosetta Stone attribute that best matches a fuzzy description, semantic phrase, or required schema shape. Searches the catalog with pagination, describes the shortlist in one batched call, ranks candidates by name + shape match, and returns the canonical attribute ID plus close alternatives. Use when: "find the X attribute", "what's the graph-edge attribute ID", "look up the email Rosetta Stone attribute", "search the attribute catalog for Y", "which attribute has SOURCE_ID + TARGET_ID + IS_DIRECTED". (narrative-common)
日本語の概要は準備中です。原文の説明を表示しています。